Having a correct information security strategic plan is huge for an
organization. Brian Evans breaks down why that is, he stated that (Evans,
2015) “An information security strategic plan can position an organization
to mitigate, transfer, accept or avoid information risk related to people,
processes and technologies. An established strategy also helps the
organization adequately protect the confidentiality, integrity, and
availability of information. The business benefits of an effective
information security strategic plan are significant and can offer a
competitive advantage. These may include complying with industry
standards, avoiding a damaging security incident, sustaining the
reputation of the business, and supporting commitment to shareholders,
customers, partners, and suppliers.” (Evans, 2015) This is important
